CVE-2024-53636

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbitrary code via ../ in the filePath parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-24

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-53646.5A vulnerability, which was classified as critical, has been found in SourceCodester Best House Rental Management System up to 1.0. Affected CVE-2024-536478.2Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email ve CVE-2024-536486.8A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 CVE-2024-536496.5A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.80), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9 CVE-2024-53656.5A vulnerability, which was classified as critical, was found in SourceCodester Best House Rental Management System up to 1.0. This affects a CVE-2024-536514.6A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (C CVE-2024-53666.5A vulnerability has been found in SourceCodester Best House Rental Management System up to 1.0 and classified as critical. This vulnerabilit CVE-2024-53676.1A vulnerability was found in Kashipara College Management System 1.0 and classified as problematic. This issue affects some unknown processi CVE-2024-536726.3A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands o CVE-2024-536739.8A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.CVE-2024-536747.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain CVE-2024-536757.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain